2025 CVEs (page 100)
Page 100 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13384 | High | 7.5 | 2025-11-22 | The CP Contact Form with PayPal plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.56. This is due to the pl… |
CVE-2025-13317 | Medium | 5.3 | 2025-11-22 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the p… |
CVE-2025-12877 | Medium | 5.3 | 2025-11-22 | The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capa… |
CVE-2025-12752 | Medium | 5.3 | 2025-11-22 | The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due… |
CVE-2025-11186 | Medium | 6.4 | 2025-11-22 | The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in… |
CVE-2025-12889 | Medium | 5.4 | 2025-11-22 | With TLS 1.2 connections a client can use any digest, specifically a weaker digest that is supported, rather than those in the CertificateRequest. |
CVE-2025-65947 | | 2025-11-21 | thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when querying thread counts on… | |
CVE-2025-65946 | High | 8.1 | 2025-11-21 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it was possible for Roo… |
CVE-2025-12888 | High | 7.5 | 2025-11-21 | Vulnerability in X25519 constant-time cryptographic implementations due to timing side channels introduced by compiler optimizations and CPU architecture limit… |
CVE-2025-11936 | Medium | 5.3 | 2025-11-21 | Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a deni… |
CVE-2025-11934 | Low | 2.7 | 2025-11-21 | Improper input validation in the TLS 1.3 CertificateVerify signature algorithm negotiation in wolfSSL 5.8.2 and earlier on multiple platforms allows for downgr… |
CVE-2025-11933 | Medium | 6.5 | 2025-11-21 | Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to p… |
CVE-2025-11932 | Medium | 4.3 | 2025-11-21 | The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder |
CVE-2025-11931 | High | 8.2 | 2025-11-21 | Integer Underflow Leads to Out-of-Bounds Access in XChaCha20-Poly1305 Decrypt. This issue is hit specifically with a call to the function wc_XChaCha20Poly1305_… |
CVE-2025-65111 | Medium | 5.3 | 2025-11-21 | SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes th… |
CVE-2025-65109 | | 2025-11-21 | Minder is an open source software supply chain security platform. In Minder Helm version 0.20241106.3386+ref.2507dbf and Minder Go versions from 0.0.72 to 0.0… | |
CVE-2025-65108 | Critical | 10.0 | 2025-11-21 | md-to-pdf is a CLI tool for converting Markdown files to PDF using Node.js and headless Chrome. Prior to version 5.2.5, a Markdown front-matter block that cont… |
CVE-2025-65107 | Medium | 6.5 | 2025-11-21 | Langfuse is an open source large language model engineering platform. In versions from 2.95.0 to before 2.95.12 and from 3.17.0 to before 3.131.0, in SSO provi… |
CVE-2025-65106 | | 2025-11-21 | LangChain is a framework for building agents and LLM-powered applications. From versions 0.3.79 and prior and 1.0.0 to 1.0.6, a template injection vulnerabilit… | |
CVE-2025-65102 | | 2025-11-21 | PJSIP is a free and open source multimedia communication library. Prior to version 2.16, Opus PLC may zero-fill the input frame as long as the decoder ptime, w… | |
CVE-2025-65092 | | 2025-11-21 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder… | |
CVE-2025-43374 | Medium | 4.3 | 2025-11-21 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS So… |
CVE-2025-31266 | Medium | 4.3 | 2025-11-21 | A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5… |
CVE-2025-31248 | Medium | 5.5 | 2025-11-21 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.3… |
CVE-2025-31216 | Low | 2.4 | 2025-11-21 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a device may… |
CVE-2025-11935 | High | 7.5 | 2025-11-21 | With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with… |
CVE-2025-0504 | Medium | 5.4 | 2025-11-21 | Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with… |
CVE-2025-11087 | High | 8.8 | 2025-11-21 | The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due t… |
CVE-2025-36149 | Medium | 6.3 | 2025-11-21 | IBM Concert Software 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim. |
CVE-2025-13524 | Medium | 5.7 | 2025-11-21 | Improper resource release in the call termination process in AWS Wickr before version 6.62.13 on Windows, macOS and Linux may allow a call participant to conti… |
CVE-2025-64767 | Critical | 9.1 | 2025-11-21 | hpke-js is a Hybrid Public Key Encryption (HPKE) module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal() API has a… |
CVE-2025-64169 | Medium | 4.9 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to before 4.12.0, fim_alert() implementation d… |
CVE-2025-62626 | | 2025-11-21 | Improper handling of insufficient entropy in the AMD CPUs could allow a local attacker to influence the values returned by the RDSEED instruction, potentially… | |
CVE-2025-62609 | High | 7.5 | 2025-11-21 | MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading… |
CVE-2025-62608 | Critical | 9.1 | 2025-11-21 | MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing mal… |
CVE-2025-54866 | Medium | 5.5 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program… |
CVE-2025-48502 | Medium | 5.5 | 2025-11-21 | Improper input validation within AMD uprof can allow a local attacker to overwrite MSR registers, potentially resulting in crash or denial of service. |
CVE-2025-30201 | High | 7.7 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows au… |
CVE-2025-29934 | Medium | 5.3 | 2025-11-21 | A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data… |
CVE-2025-64483 | | 2025-11-21 | Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in cert… | |
CVE-2025-13132 | High | 7.4 | 2025-11-21 | This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, use… |
CVE-2025-13470 | High | 7.5 | 2025-11-21 | In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitia… |
CVE-2025-12973 | High | 7.2 | 2025-11-21 | The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file typ… |
CVE-2025-12747 | Medium | 5.3 | 2025-11-21 | The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being… |
CVE-2025-41115 | Critical | 10.0 | 2025-11-21 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing… |
CVE-2025-13432 | Medium | 4.3 | 2025-11-21 | Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the altera… |
CVE-2025-13357 | High | 7.4 | 2025-11-21 | Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insec… |
CVE-2025-11127 | Critical | 9.8 | 2025-11-21 | The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX… |
CVE-2025-66115 | Medium | 6.6 | 2025-11-21 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice… |
CVE-2025-66114 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting In… |
CVE-2025-66113 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-66112 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-66111 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XS… |
CVE-2025-66110 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66109 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-66108 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66107 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly… |
CVE-2025-66106 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-66101 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66099 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-66098 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS… |
CVE-2025-66097 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Term… |
CVE-2025-66096 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66095 | High | 8.5 | 2025-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2025-66093 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map… |
CVE-2025-66092 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored X… |
CVE-2025-66091 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator al… |
CVE-2025-66090 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based… |
CVE-2025-66089 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-66087 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-66086 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66085 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-66084 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66083 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66082 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66081 | Medium | 5.9 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Head Meta Data head-meta-data allows Stored XS… |
CVE-2025-66079 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-66077 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-66075 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66073 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through… |
CVE-2025-66072 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Users… |
CVE-2025-66071 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly C… |
CVE-2025-66069 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-66067 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows DO… |
CVE-2025-66066 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This i… |
CVE-2025-66065 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-66064 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue a… |
CVE-2025-66063 | Medium | 5.4 | 2025-11-21 | Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66062 | Low | 3.4 | 2025-11-21 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTu… |
CVE-2025-66061 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This… |
CVE-2025-66060 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-66059 | Medium | 5.3 | 2025-11-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcastin… |
CVE-2025-66057 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows DOM… |
CVE-2025-66056 | Medium | 4.3 | 2025-11-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Emb… |
CVE-2025-66055 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email S… |
CVE-2025-66053 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects… |
CVE-2025-12935 | Medium | 6.4 | 2025-11-21 | The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cr… |
CVE-2025-10054 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-10039 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2025-40211 | | 2025-11-21 | In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_w… |